Code review fixes: wardrobe migration, response validation, path traversal guard, deduplication

- Migrate 11 character JSONs from old wardrobe keys to _BODY_GROUP_KEYS format
- Add is_favourite/is_nsfw columns to Preset model
- Add HTTP response validation and timeouts to ComfyUI client
- Add path traversal protection on replace cover route
- Deduplicate services/mcp.py (4 functions → 2 generic + 2 wrappers)
- Extract apply_library_filters() and clean_html_text() shared helpers
- Add named constants for 17 ComfyUI workflow node IDs
- Fix bare except clauses in services/llm.py
- Fix tags schema in ensure_default_outfit() (list → dict)
- Convert f-string logging to lazy % formatting
- Add 5-minute polling timeout to frontend waitForJob()
- Improve migration error handling (non-duplicate errors log at WARNING)
- Update CLAUDE.md to reflect all changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

services/llm.py

@@ -205,13 +205,13 @@ def call_llm(prompt, system_prompt="You are a creative assistant."):
         except requests.exceptions.RequestException as e:
             error_body = ""
             try: error_body = f" - Body: {response.text}"
-            except: pass
+            except Exception: pass
             raise RuntimeError(f"LLM API request failed: {str(e)}{error_body}") from e
         except (KeyError, IndexError) as e:
             # Log the raw response to help diagnose the issue
             raw = ""
             try: raw = response.text[:500]
-            except: pass
+            except Exception: pass
             logger.warning("Unexpected LLM response format (key=%s). Raw response: %s", e, raw)
             if format_retries > 0:
                 format_retries -= 1